nerdexam
CompTIA

CAS-002 · Question #356

Ann, a systems engineer, is working to identify an unknown node on the corporate network. To begin her investigative work, she runs the following nmap command string: user@hostname:~$ sudo nmap -O…

The correct answer is C. Solaris. The combination of open ports - rpcbind (111), r-services (512-514), NFS (2049), and high RPC ports - is a classic Solaris fingerprint not typically seen on Linux, Windows, or macOS.

Research and Analysis

Question

Ann, a systems engineer, is working to identify an unknown node on the corporate network. To begin her investigative work, she runs the following nmap command string:

user@hostname:~$ sudo nmap –O 192.168.1.54 Based on the output, nmap is unable to identify the OS running on the node, but the following ports are open on the device:

TCP/22 TCP/111 TCP/512-514 TCP/2049 TCP/32778 Based on this information, which of the following operating systems is MOST likely running on the unknown node?

Options

  • ALinux
  • BWindows
  • CSolaris
  • DOSX

How the community answered

(57 responses)
  • A
    5% (3)
  • B
    19% (11)
  • C
    65% (37)
  • D
    11% (6)

Why each option

The combination of open ports - rpcbind (111), r-services (512-514), NFS (2049), and high RPC ports - is a classic Solaris fingerprint not typically seen on Linux, Windows, or macOS.

ALinux

Linux does not expose r-services (TCP/512-514) or high-numbered RPC ports like 32778 in a default installation, making this port profile inconsistent with a standard Linux host.

BWindows

Windows uses entirely different default ports such as TCP/135 (RPC Endpoint Mapper), TCP/139, and TCP/445 (SMB) and does not natively run NFS or r-services.

CSolarisCorrect

Solaris systems historically run rpcbind on TCP/111, legacy r-services (rsh, rlogin, rexec) on TCP/512-514, NFS on TCP/2049, and dynamic RPC services on high ports like 32778. This specific combination of legacy Sun/Oracle Unix services is a strong indicator of a Solaris host, distinguishing it from Linux or other Unix-like systems that do not expose this exact set of default services by default.

DOSX

macOS does not run legacy r-services or expose the high-numbered RPC ports seen in this profile in any default configuration.

Concept tested: nmap OS fingerprinting via open port analysis

Source: https://nmap.org/book/osdetect.html

Topics

#OS fingerprinting#nmap#network reconnaissance#port analysis

Community Discussion

No community discussion yet for this question.

Full CAS-002 Practice